Dear all, I vae the C115 with a T1 USB to Serial cable with the Prolific
chipset.
When i run osmocon i get :- an its just sits there with no further
processing.
./osmocon -p /dev/ttyUSB0 -m c123xor
../../target/firmware/board/compal_e88/loader.compalram.bin
read_file(../../target/firmware/board/compal_e88/loader.compalram.bin):
file_size=17120, hdr_len=4, dnload_len=17127
read_file(../../target/firmware/board/compal_e88/loader.compalram.bin):
file_size=17120, hdr_len=4, dnload_len=17127
got 1 bytes from modem, data looks like: 00 .
got 2 bytes from modem, data looks like: 2f 00 /.
got 1 bytes from modem, data looks like: 1b .
got 3 bytes from modem, data looks like: f6 02 00 ...
got 1 bytes from modem, data looks like: 41 A
got 1 bytes from modem, data looks like: 01 .
got 1 bytes from modem, data looks like: 40 @
Received PROMPT1 from phone, responding with CMD
got 1 bytes from modem, data looks like: 66 f
got 1 bytes from modem, data looks like: 74 t
got 1 bytes from modem, data looks like: 6d m
got 1 bytes from modem, data looks like: 74 t
got 1 bytes from modem, data looks like: 6f o
got 1 bytes from modem, data looks like: 6f o
got 1 bytes from modem, data looks like: 6c l
Received FTMTOOL from phone, ramloader has aborted
got 1 bytes from modem, data looks like: 65 e
got 1 bytes from modem, data looks like: 72 r
got 1 bytes from modem, data looks like: 72 r
got 1 bytes from modem, data looks like: 6f o
got 1 bytes from modem, data looks like: 72 r
got 1 bytes from modem, data looks like: 00 .
got 1 bytes from modem, data looks like: 00 .
I think the cable is ok as when i run my fingers on the tip i get random
Zeros so it appears to be talking to the cable.
Also when i tried to run Mobile i get the :- even though i created the
Mobile.cfg file in /etc/osmoco
Failed to parse the config file: '/home/raz/.osmocom/bb/mobile.cfg'
Please check or create config file using: 'touch
/home/raz/.osmocom/bb/mobile.cfg'
I have spent some hours researching the lists and trying various things to
no avail but I want to continue until I resolve this issues and use this
great stack to learn about the GSM network.
Please advise.
Great full for any help or pointers but this maybe a timing issue that is
difficult to debug.
Thanks
Raz
hi,
i did a lot of resarch and testing on cell selection and re-selection
process the last two week.
the cell selection process, network selection process (manual and
automatic) and mobility management process were already implemented in
OsmocomBB a long time, but turned out to be buggy and incomplete. i made
test drives to check the process and debugged it.
the re-selection process is new. it is used to track surrounding cells
while listening to the BCCH of the current cell (camping on a cell).
special extension to the layer1 firmare is used to measure neighbour
cells. if an neighbour cell becomes 'better', the mobile switches to
that cell, depening on different criteria. now it is possible to move
with OsmocomBB.
the re-selection process is not handover! handover is a process where a
phone switches between cells while doing a call. handover is one next
step to implement. the process is a little more complex, because it
requires not only neighbour cell measurements, but also syncing to them
without interrupting the traffic channel. most layer 3 stuff of handover
is already implemented.
if you like to play and test your moving OsmocomBB, you can check out
the "jolly/roaming" branch. it contains the extension to layer1, as well
as sim reader and fixes from "sylvain/testing" branch. use both "mobile"
and "layer1" firmware from this branch.
in order to see some process at VTY, you can do:
enable
monitor network 1 (continously display the strongest cell and neighbour
cells)
show ms 1 (to see current states)
show neighbour-cells 1 (to see a more detailed current list of
neighbours)
andreas
Hi,
in the osmocom bb mobile.cfg I don't see any posibility to set a fixed
Kc encryption key and the tmsi.
How could I achieve that osmocom uses my defined Kc and tmsi?
cheers,
Simian
Hi,
I'm trying to run the latest osmocom-bb git on a Motorola C118 phone.
After a minor problem with the build (as you may've noticed in the
patch I've sent). I got to the point of successfuly running layer1 on
the phone and the mobile app on the PC (I have also enabled TX). The
process seems to be stuck on trying to perform a location update. The
status of the ms is always either:
show ms
MS '1' is up, MM connection active
IMEI: 000000000000000
IMEISV: 0000000000000000
IMEI generation: fixed
automatic network selection state: A1 trying RPLMN
MCC=104 MNC=002 (104, 002)
cell selection state: connected mode 1
ARFCN=19 MCC=104 MNC=002 LAC=0xb00f CELLID=0x4fd9
(104, 002)
radio ressource layer state: connection pending
mobility management layer state: wait for RR connection (location updating)
OsmocomBB>
or
show ms
MS '1' is up, service is limited (pending)
IMEI: 000000000000000
IMEISV: 0000000000000000
IMEI generation: fixed
automatic network selection state: A1 trying RPLMN
MCC=104 MNC=002 (104, 002)
cell selection state: C3 camped normally
ARFCN=19 MCC=104 MNC=002 LAC=0xb00f CELLID=0x4fd9
(104, 002)
radio ressource layer state: idle
mobility management layer state: MM idle, attempting to update
OsmocomBB>
I think, that because of this I can't make any calls or send sms (all
the requests are being rejected):
OsmocomBB# call 1 <X>
call 1 <X>
OsmocomBB#
% (MS 1)
% Call has been rejected
The log information from mobile when it's trying to do a location
update is show below:
<000b> gsm48_rr.c:2174 PAGING REQUEST 1
<000b> gsm48_rr.c:2141 IMSI 260021964220249 (not for us)
<000b> gsm48_rr.c:2132 TMSI fd82a501 (not for us)
<000e> gsm48_mm.c:344 Location update retry
<0005> gsm48_mm.c:345 timer T3211 (loc. upd. retry delay) has fired
<0005> gsm48_mm.c:4311 (ms 1) Received 'MM_EVENT_TIMEOUT_T3211' event
in state MM IDLE, attempting to update
<000e> gsm48_mm.c:2199 Perform location update (MCC 104, MNC 002 LAC 0xb00f)
<0005> gsm48_mm.c:2333 LOCATION UPDATING REQUEST
<0005> gsm48_mm.c:2355 using LAI (mcc 104 mnc 002 lac 0xb00f)
<0005> gsm48_mm.c:2363 using TMSI 0x28a3d62e
<0005> gsm48_mm.c:914 new state MM IDLE, attempting to update -> wait
for RR connection (location updating)
<0001> gsm48_rr.c:5428 (ms 1) Message 'RR_EST_REQ' received in state
idle (sapi 0)
<000e> gsm48_rr.c:1318 Establish radio link due to mobility management request
<0003> gsm322.c:4037 (ms 1) Event 'EVENT_LEAVE_IDLE' for Cell
selection in state 'C3 camped normally'
<0003> gsm322.c:823 new state 'C3 camped normally' -> 'connected mode 1'
<0003> gsm322.c:3653 Going to camping (normal) ARFCN 19.
<0003> gsm322.c:463 Sync to ARFCN=19 rxlev=-74 (Sysinfo, ccch mode NON-COMB)
<0001> gsm48_rr.c:366 new state idle -> connection pending
<0001> gsm48_rr.c:1465 CHANNEL REQUEST: 00 (Location Update with NECI)
<0003> gsm322.c:2938 Channel synched. (ARFCN=19, snr=16, BSIC=17)
<0001> gsm322.c:2959 using DSC of 90
<0003> gsm48_rr.c:4816 Channel provides data.
<0001> gsm48_rr.c:1601 RANDOM ACCESS (requests left 5)
<0001> gsm48_rr.c:1658 RANDOM ACCESS (Tx-integer 50 combined no
S(lots) 0 ra 0x0e)
<0001> gsm48_rr.c:1697 Use MS-TXPWR-MAX-CCH power value 5 (33 dBm)
<0001> gsm48_rr.c:2170 PAGING ignored, we are not camping.
<0001> gsm48_rr.c:1601 RANDOM ACCESS (requests left 4)
<0001> gsm48_rr.c:1658 RANDOM ACCESS (Tx-integer 50 combined no
S(lots) 55 ra 0x07)
<0001> gsm48_rr.c:1697 Use MS-TXPWR-MAX-CCH power value 5 (33 dBm)
<0001> gsm48_rr.c:2450 IMMEDIATE ASSIGNMENT:
<0001> gsm48_rr.c:2462 (ta 2/1107m ra 0x75 chan_nr 0x0a MAIO 0 HSN 38
TS 2 SS 0 TSC 0)
<0001> gsm48_rr.c:2503 Request, but not for us.
<0001> gsm48_rr.c:2450 IMMEDIATE ASSIGNMENT:
<0001> gsm48_rr.c:2462 (ta 2/1107m ra 0x75 chan_nr 0x0a MAIO 0 HSN 38
TS 2 SS 0 TSC 0)
<0001> gsm48_rr.c:2503 Request, but not for us.
<0001> gsm48_rr.c:2170 PAGING ignored, we are not camping.
<0001> gsm48_rr.c:2170 PAGING ignored, we are not camping.
<0001> gsm48_rr.c:673 MON: f=19 lev=-78 snr= 0 ber= 0 LAI=104 002 b00f ID=4fd9
<0001> gsm48_rr.c:2170 PAGING ignored, we are not camping.
<0001> gsm48_rr.c:1601 RANDOM ACCESS (requests left 3)
<0001> gsm48_rr.c:1658 RANDOM ACCESS (Tx-integer 50 combined no
S(lots) 55 ra 0x0f)
<0001> gsm48_rr.c:1697 Use MS-TXPWR-MAX-CCH power value 5 (33 dBm)
<0001> gsm48_rr.c:2170 PAGING ignored, we are not camping.
<0001> gsm48_rr.c:1601 RANDOM ACCESS (requests left 2)
<0001> gsm48_rr.c:1658 RANDOM ACCESS (Tx-integer 50 combined no
S(lots) 55 ra 0x01)
<0001> gsm48_rr.c:1697 Use MS-TXPWR-MAX-CCH power value 5 (33 dBm)
<0001> gsm48_rr.c:2450 IMMEDIATE ASSIGNMENT:
<0001> gsm48_rr.c:2473 (ta 1/553m ra 0x18 chan_nr 0x59 ARFCN 19 TS 1
SS 3 TSC 1)
<0001> gsm48_rr.c:2503 Request, but not for us.
<0001> gsm48_rr.c:2450 IMMEDIATE ASSIGNMENT:
<0001> gsm48_rr.c:2473 (ta 1/553m ra 0x18 chan_nr 0x59 ARFCN 19 TS 1
SS 3 TSC 1)
<0001> gsm48_rr.c:2503 Request, but not for us.
<0001> gsm48_rr.c:2170 PAGING ignored, we are not camping.
<0001> gsm48_rr.c:1601 RANDOM ACCESS (requests left 1)
<0001> gsm48_rr.c:1658 RANDOM ACCESS (Tx-integer 50 combined no
S(lots) 55 ra 0x0a)
<0001> gsm48_rr.c:1697 Use MS-TXPWR-MAX-CCH power value 5 (33 dBm)
<0001> gsm48_rr.c:2170 PAGING ignored, we are not camping.
<0001> gsm48_rr.c:2170 PAGING ignored, we are not camping.
<0001> gsm48_rr.c:673 MON: f=19 lev=-78 snr= 0 ber= 1 LAI=104 002 b00f ID=4fd9
<0001> gsm48_rr.c:2170 PAGING ignored, we are not camping.
<0001> gsm48_rr.c:1601 RANDOM ACCESS (requests left 0)
<0001> gsm48_rr.c:1605 Done with sending RANDOM ACCESS bursts
<0001> gsm48_rr.c:836 starting T3126 with 5.000 seconds
<0001> gsm48_rr.c:2170 PAGING ignored, we are not camping.
<0001> gsm48_rr.c:2225 PAGING ignored, we are not camping.
<0001> gsm48_rr.c:2170 PAGING ignored, we are not camping.
<0001> gsm48_rr.c:2170 PAGING ignored, we are not camping.
<0001> gsm48_rr.c:2170 PAGING ignored, we are not camping.
<0001> gsm48_rr.c:2170 PAGING ignored, we are not camping.
<0001> gsm48_rr.c:673 MON: f=19 lev=-78 snr= 0 ber= 0 LAI=104 002 b00f ID=4fd9
<0001> gsm48_rr.c:2450 IMMEDIATE ASSIGNMENT:
<0001> gsm48_rr.c:2473 (ta 2/1107m ra 0x0a chan_nr 0x41 ARFCN 19 TS 1
SS 0 TSC 1)
<0001> gsm48_rr.c:2393 request 0a matches but not frame number
(IMM.ASS fn=22,6,30 != RACH fn=22,5,25)
<0001> gsm48_rr.c:2503 Request, but not for us.
<0001> gsm48_rr.c:2170 PAGING ignored, we are not camping.
<0001> gsm48_rr.c:2170 PAGING ignored, we are not camping.
<0001> gsm48_rr.c:2170 PAGING ignored, we are not camping.
<0001> gsm48_rr.c:2450 IMMEDIATE ASSIGNMENT:
<0001> gsm48_rr.c:2473 (ta 2/1107m ra 0x05 chan_nr 0x49 ARFCN 19 TS 1
SS 1 TSC 1)
<0001> gsm48_rr.c:2503 Request, but not for us.
<0001> gsm48_rr.c:2450 IMMEDIATE ASSIGNMENT:
<0001> gsm48_rr.c:2473 (ta 2/1107m ra 0x05 chan_nr 0x49 ARFCN 19 TS 1
SS 1 TSC 1)
<0001> gsm48_rr.c:2503 Request, but not for us.
<0001> gsm48_rr.c:2225 PAGING ignored, we are not camping.
<0001> gsm48_rr.c:2170 PAGING ignored, we are not camping.
<0001> gsm48_rr.c:2170 PAGING ignored, we are not camping.
<0001> gsm48_rr.c:673 MON: f=19 lev=-77 snr= 0 ber= 6 LAI=104 002 b00f ID=4fd9
<0001> gsm48_rr.c:2170 PAGING ignored, we are not camping.
<0001> gsm48_rr.c:2170 PAGING ignored, we are not camping.
<0001> gsm48_rr.c:2170 PAGING ignored, we are not camping.
<0001> gsm48_rr.c:2450 IMMEDIATE ASSIGNMENT:
<0001> gsm48_rr.c:2473 (ta 2/1107m ra 0x00 chan_nr 0x61 ARFCN 19 TS 1
SS 4 TSC 1)
<0001> gsm48_rr.c:2503 Request, but not for us.
<0001> gsm48_rr.c:2450 IMMEDIATE ASSIGNMENT:
<0001> gsm48_rr.c:2473 (ta 2/1107m ra 0x00 chan_nr 0x61 ARFCN 19 TS 1
SS 4 TSC 1)
<0001> gsm48_rr.c:2503 Request, but not for us.
<0001> gsm48_rr.c:2450 IMMEDIATE ASSIGNMENT:
<0001> gsm48_rr.c:2462 (ta 2/1107m ra 0x7d chan_nr 0x0b MAIO 0 HSN 38
TS 3 SS 0 TSC 0)
<0001> gsm48_rr.c:2503 Request, but not for us.
<0001> gsm48_rr.c:2170 PAGING ignored, we are not camping.
<0001> gsm48_rr.c:2450 IMMEDIATE ASSIGNMENT:
<0001> gsm48_rr.c:2462 (ta 2/1107m ra 0x7d chan_nr 0x0b MAIO 0 HSN 38
TS 3 SS 0 TSC 0)
<0001> gsm48_rr.c:2503 Request, but not for us.
<0001> gsm48_rr.c:2170 PAGING ignored, we are not camping.
<0001> gsm48_rr.c:2170 PAGING ignored, we are not camping.
<0001> gsm48_rr.c:2170 PAGING ignored, we are not camping.
<0001> gsm48_rr.c:2170 PAGING ignored, we are not camping.
<0001> gsm48_rr.c:673 MON: f=19 lev=-78 snr= 0 ber= 0 LAI=104 002 b00f ID=4fd9
<0001> gsm48_rr.c:2170 PAGING ignored, we are not camping.
<0001> gsm48_rr.c:2170 PAGING ignored, we are not camping.
<0001> gsm48_rr.c:2225 PAGING ignored, we are not camping.
<0001> gsm48_rr.c:2170 PAGING ignored, we are not camping.
<0001> gsm48_rr.c:2170 PAGING ignored, we are not camping.
<0001> gsm48_rr.c:2170 PAGING ignored, we are not camping.
<0001> gsm48_rr.c:2170 PAGING ignored, we are not camping.
<0001> gsm48_rr.c:2225 PAGING ignored, we are not camping.
<0001> gsm48_rr.c:2170 PAGING ignored, we are not camping.
<0001> gsm48_rr.c:2170 PAGING ignored, we are not camping.
<0001> gsm48_rr.c:673 MON: f=19 lev=-78 snr= 0 ber= 3 LAI=104 002 b00f ID=4fd9
<0001> gsm48_rr.c:2170 PAGING ignored, we are not camping.
<0001> gsm48_rr.c:2170 PAGING ignored, we are not camping.
<0001> gsm48_rr.c:2170 PAGING ignored, we are not camping.
<0001> gsm48_rr.c:2170 PAGING ignored, we are not camping.
<0001> gsm48_rr.c:2170 PAGING ignored, we are not camping.
<0001> gsm48_rr.c:2170 PAGING ignored, we are not camping.
<0001> gsm48_rr.c:2170 PAGING ignored, we are not camping.
<0001> gsm48_rr.c:2170 PAGING ignored, we are not camping.
<0001> gsm48_rr.c:2170 PAGING ignored, we are not camping.
<0001> gsm48_rr.c:2450 IMMEDIATE ASSIGNMENT:
<0001> gsm48_rr.c:2462 (ta 2/1107m ra 0x77 chan_nr 0x09 MAIO 0 HSN 38
TS 1 SS 0 TSC 0)
<0001> gsm48_rr.c:2503 Request, but not for us.
<0001> gsm48_rr.c:2450 IMMEDIATE ASSIGNMENT:
<0001> gsm48_rr.c:2462 (ta 2/1107m ra 0x77 chan_nr 0x09 MAIO 0 HSN 38
TS 1 SS 0 TSC 0)
<0001> gsm48_rr.c:2503 Request, but not for us.
<0001> gsm48_rr.c:2225 PAGING ignored, we are not camping.
<0001> gsm48_rr.c:2170 PAGING ignored, we are not camping.
<0001> gsm48_rr.c:673 MON: f=19 lev=-78 snr= 0 ber= 6 LAI=104 002 b00f ID=4fd9
<0001> gsm48_rr.c:765 timer T3126 has fired
<000e> gsm48_rr.c:770 Requesting channel failed
<0001> gsm48_rr.c:366 new state connection pending -> idle
<0003> gsm322.c:4037 (ms 1) Event 'EVENT_RET_IDLE' for Cell selection
in state 'connected mode 1'
<0003> gsm322.c:3565 Selecting ARFCN 19. after LOC.UPD.
<0003> gsm322.c:463 Sync to ARFCN=19 rxlev=-74 (Sysinfo, ccch mode NON-COMB)
<0003> gsm322.c:823 new state 'connected mode 1' -> 'C3 camped normally'
<0005> gsm48_mm.c:3902 (ms 1) Received 'RR_REL_IND' from RR in state
wait for RR connection (location updating) (sapi 0)
<0005> gsm48_mm.c:2732 RR link released after loc. upd.
<000e> gsm48_mm.c:2676 Location update failed
<000e> gsm48_mm.c:2686 Try location update later
<0005> gsm48_mm.c:2688 Loc. upd. failed, retry #0
<0005> gsm48_mm.c:413 starting T3211 (loc. upd. retry delay) with 15.0 seconds
<0005> gsm48_mm.c:1143 We are camping normally as returning to MM IDLE
<0005> gsm48_mm.c:1159 Loc. upd. allowed.
<0005> gsm48_mm.c:919 new state wait for RR connection (location
updating) -> MM IDLE, location updating needed
<0005> gsm48_mm.c:909 new MM IDLE state location updating needed ->
attempting to update
<0005> gsm48_mm.c:2215 Loc. upd. already pending.
<0005> gsm48_mm.c:4311 (ms 1) Received 'MM_EVENT_CELL_SELECTED' event
in state MM IDLE, attempting to update
<0005> gsm48_mm.c:2215 Loc. upd. already pending.
<0003> gsm322.c:2938 Channel synched. (ARFCN=19, snr=16, BSIC=17)
<0001> gsm322.c:2959 using DSC of 90
Can you provide me any hints on how to debug this ? Why is the
location update failing constantly ?
Thanks in advance for your help.
Best regards,
Maciej Grela
So far three persons have indicated their interest to join
a meeting at my place.
Considering the time it takes to drive to my place, it
probably makes sense to have the meeting at the weekend
(either Saturday or Sunday) so that there is more time
for the meeting itself. I can suggest one of the following
dates for the first meeting, somewhere between 10:00 to
18:00 on each day:
25.8. (Sa) or 26.8. (Su)
1.9. (Sa) or 2.9. (Su)
8.9. (Sa) or 9.9. (Su)
So please let me know when you have time and also make
suggestions in which Osmocom topic you are interested
in so that we can have some sort of agenda for the
meeting to make best use of the time.
Best regards,
Dieter
--
Dieter Spaar, Germany spaar(a)mirider.augusta.de
Hello.
I'm having troubles compiling asn.1 files from
http://www.3gpp.org/ftp/Specs/archive/24_series/24.080/ASN.1/
I'm getting syntax error (syntax error at line 264 in module SS-Operations.asn: got
'SEQUENCE' expected ':') while running
erlc SS-Operations.asn
using Erlang version 15.b.1
As far as I recall Harald has done this for MAP asn.1
Are there any hints on what might be wrong?
Tried online compiler but it gives different errors in different places.
Should I use different version? Compile smth else before attempting to compile this
file? Fix syntax using some clever trick? Do some rtfm?
Any advices would be greatly appreciated.
--
best regards,
Max, http://fairwaves.ru
hi josephli,
> Read stored BA list mnc=01
the mobile application stores the last cells and neighbour cells (band
allocation) of each network. this way the scanning is much
faster when restarting. because you use the SIM card with MNC == 02 the
first time, there is no band allocation stored for that. the mobile will
do a full scan in this case.
> while the sim card service I am tesing is actually with mnc 00 and 02.
i know that MNC == 0 will not work until i commited improvements of cell
selection process last sunday. you should retry that, but first try with
an MNC > 0.
can you provide debug output when trying a call?
also can you provide VTY output of "show ms" before you make the call?
regards,
andreas
hi,
i just fixed some locking issues the last days. fix will follow. it took
a bit longer, because there were some race conditions. it took up to
about one hour until it crashed. my way to detect the area where the
crash happened, was to turn on buzzer before that area, and turn it off
after that area. after many hours of approximation, i finally found out
that the major crash happend during _talloc_zero. (first it looks for a
free memory chunk, then it allocates it.) since it can be called from
all contexts (main, irq, fiq), it need to be locked against any
interrupt, otherwise the memory chunk can be assigned multiple times.
(the process of _talloc_free is "atomic" and requires no locking.)
because it seems pretty stable, i think it is time to merge some
branches into the master. (i made a 6 hours call yesterday. and no crash
after bugfix ever since.) i will do that together with sylvain, if we
find the time this weekend.
currently i use the jolly/voice together with the sylvain/traffic
branch. i am able to use an isdn phone togehter with linux-call-router
and make/receive calls. audio is passed both ways. i think this is a
stage where it actually become "usable". (if not moving arround.)
one of my major work for the next weeks/months will be the neighbour
cell measurement, cell re-selection, and handover. this is essential
when moving with the phone.
regards,
andreas
Hi ,List:
search some materials, find that the decode method of AFS convolutional
code is different from the EFS`, it use RSC, and need SOVA(soft output
viterbi algorithm). am i right?
--
View this message in context: http://baseband-devel.722152.n3.nabble.com/is-the-Viterbi-decode-for-the-AF…
Sent from the baseband-devel mailing list archive at Nabble.com.
I'm experimenting with burst-ind branch and am able to track control
messages in ccch_scan.
I then send an Assignment Command to change to a traffic channel. I can see
the bursts come in, but cannot make out the format of the data.
If I understand right, the burst_ind structure holds 15 bytes of data, but
the traffic data should be 33 bytes. I assume the traffic data is spread
across several burst-ind messages.
Can you please clarify how to re-assemble the full 33-byte traffic data
structure from the burst_ind messages?
Thanks.
B.
Hello,
I know that there is a hardware replacement kit that is available for Osmocombb phones that help make the phones be used as uplink sniffers, but unfortunately the kit uses components that operate in the European GSM bands. Are there any hardware replacement kits for Osmocombb phones that operate in the U.S. GSM frequency bands?
Sincerely,
Roderick Ernest
I've been experimenting with decoding AMR in burst_ind with the following
steps:
1. Ignore SACCH and UL frames
2. check for FACCH
3. check for CMI/CMR (only on specific frame numbers) and change codec if
necessary after 12 frames
4. check for RATSCCH, if necessary change codec after 12 frames
Can anyone confirm that this is the proper process?
I've looked at Bob's code of July 2012. It does not use the above checks
which may be the reason for its failure.
B.
=====================
From: bob <avwiseav <at> gmail.com>
Subject: is my patch for capturing TCH frame
correctly?<http://news.gmane.org/find-root.php?message_id=%3c1342688308441%2d4025199.p…>
Newsgroups: gmane.comp.mobile.osmocom.baseband.devel<http://news.gmane.org/gmane.comp.mobile.osmocom.baseband.devel>
Date: 2012-07-19 08:58:28 GMT (27 weeks, 6 days, 20 hours and 14 minutes
ago)
Hi, everyone interesting the topic, this is my latest patch for TCH decode,
fix few bug;
but it not work well for TCH AMR decode, welcome everyone interesting it to
review it and
modify it!
the most problem now I think is the capture of the Correct TCH frame, at the
last ,there is
some output for analysis
--- app_ccch_scan.c 2012-03-14 16:08:11.305112000 +0800
+++ new_app_ccch_scan.c 2012-07-19 15:32:31.945314000 +0800
<at> <at> -50,20 +50,80 <at> <at>
#include <l1ctl_proto.h>
#include <osmocom/bb/misc/xcch.h>
+#include <codec.h>
+#include "conv_tch_afs.h"
+//#include "../openbtsstuff/GSML1FEC.h"
+//extern bool TCHFACCHL1Decoder::processBurst( const RxBurst& inBurst);
+//const struct osmo_conv_code conv_tch_afs_12_2;
+extern FILE *log_tmsi;
extern struct gsmtap_inst *gsmtap_inst;
+FILE *d_speech_file;
+const unsigned char amr_nb_magic[6] = { 0x23, 0x21, 0x41, 0x4d, 0x52, 0x0a
};
+
Hello,
I've found a very interesting article about SciphoneDream G2 published on your webpage at http://bb.osmocom.org/trac/wiki/SciphoneDreamG2 that covers pretty detailed information about MT6235 SoC, bootstrapping as well as JTAG. This is the only article I have ever found on internet about MTK SoC and JTAG.
What I am trying to accomplish is to access NAND flash and write to it over JTAG (in order to recover from corruption after bad flash) on MTK8555 SoC which according to my in-depth research and analysis has very similar architecture to MT6235. If I can't write to NAND over JTAG but would be able to launch u-boot that would be a solution too. I am very good at ARM assembly and debugging, however I am not very experienced with JTAG. Do you think you (or anyone else) could help me out, by giving me guidance what hardware, software, config files should I use to make JTAG work on this SoC ? Any help or advise would be more then appreciated!
If you are a wrong person I contacted, I apologize for the inconvenience.
Many thanks in advance!
Dwayne
In enum gsm48_chan_mode definitions we have: GSM48_CMODE_DATA_3k6 = 0x23,
It should be 0x13 as in 3GPP TS 04.08 / 10.5.2.6.
Please update in repository.
Hi,
I have bought two phones... Motorola C139 and Motorola C115. I'm using
the raspberry PI UART instead of a dedicated cable and got the hello
world example working just fine on the C115.
My goal is to have a usable open source phone which I see there is a bit of a start at in the source code.
I've been working on getting debian on my Motorola Defy for a while and am making some progress.
Since I have two phones... I am certainly willing to help in testing
things. I can't promise a lot of time but I can hope to help a little.
Thanks for your efforts,
Craig Comstock
Lawrence, KS
Dear sylvain
I checked on your website you gave some other way of doing filter rework.
I checked tried to check problem n checked possible shorts. but multi meter
shows all part are shorted. also checked each components but it shows that
there is direct connection in between all points of baluns.
i would like to try other way for same
--
Akib Sayyed
Matrix-Shell
akibsayyed(a)gmail.com
akibsayyed(a)matrixshell.com
Mob:- +91-966-514-2243
Dear list i see there is target_dsp firmware.
as per readme found inside it dumps dsp data on console.
but i am unable to compile. it needs tic54x-coff but couldnt find it. can
any one guide me through this.
--
Akib Sayyed
Matrix-Shell
akibsayyed(a)gmail.com
akibsayyed(a)matrixshell.com
Mob:- +91-966-514-2243
Dear All
Currently i am trying to implement AMR codec for Mobile App.
Please guide me for same.
I am not that good in channel decoding. if anyone have given a try or have
partial code implementation please help me in that.
--
Akib Sayyed
Matrix-Shell
akibsayyed(a)gmail.com
akibsayyed(a)matrixshell.com
Mob:- +91-966-514-2243
Hi!
First I do not know if this is the proper mailing lists, as I am not a
developer but a user. But I couldn't find a user list. So please advice
if there is a better list.
I started playing with Osmocom and my "brand new" C118 :-) and meanwhile
I made my first open source GSM phone call. Following is my list of
questions and suggestions I experienced so far:
- Build System: since the "Use the system wide libosmocore for host
applications" commit it is required that libosmocore is built
separately. But the documentation is still confusing. Thus I think it
would be good to:
- remove the libosmocore subtree git from osmocom-bb git
- remove this line of text from
http://bb.osmocom.org/trac/wiki/libosmocore: "When you download and
build OsmocomBB, then libosmocore is automatically part of the package,
no special action is required."
- osmocom: some wiki pages refer to an "osmocom" application. Is there
an osmocom binary? (I think most times it is a typo for osmocon)
- I use Wireshark to capture the GSMTAP packets of "monitor". How do I
find out in the Wireshark trace if a message is sent from the MS or is
received by the MS?
- I want to study the high layer messages (e.g. not cell selection but
call setup, registering to the network) but I am lost in the debug
flags: DCS:DNB:DPLMN:DRR:DMM:DSIM:DCC:DMNCC:DSS:DLSMS:DPAG:DSUM. Which
ones are needed in my case? Is there somewhere a description of the flags?
- Some tools (e.g. cell_log) give 'SAP' log messages, e.g:
Failed to connect to '/tmp/osmocom_sap'.
Failed during sap_open(), no SIM reader
I suspect this is for communcation with SIM cards. How it is supposed to
work?
- Is this 'SAP' stuff only needed/useful for softSIMs?
- Which application should create the /tmp/osmocom_sap socket? (osmocon
only creates /tmp/osmocom_l2 and /tmp/osmocom_loader)
- Would it be possible to remove the SIM card from my C118 and put it in
an external SIM reader, and then let "mobile" use the SIM card in the
external reader instead?
Thanks
Klaus
PS: I'm willing to improve the documentation in the wiki with your
answers ;-)
Dear All
I need instructions for flashing c155 with custom firmware.
also i need to build linker script too.what all changes need to be done in
flash.lds for e88 hw. will changes in only address and size part will work
??
can any one help me ??
--
Akib Sayyed
Matrix-Shell
akibsayyed(a)gmail.com
akibsayyed(a)matrixshell.com
Mob:- +91-966-514-2243
Hi!
The last days I experienced the website is sometimes very slow. Requests
takes up to 30 seconds to be answered by the server.
http://bb.osmocom.org/ is fast, but http://bb.osmocom.org/trac/ is slow.
Thus I suspect a Trac or database problem.
regards
Klaus
Hi,
I already mentioned a strange behavior, sometimes when running osmocom for
a few days. I think this is a different issue, because it happens more
frequently and the situation is a bit different. This problem does not
occur with a binary from june 2012. So it has to be some change between
june and now.
But now the problem: When running a phone with the main branch (only
tested), it sometime come to the situation that the phone says "connection
pending" and is not reacting anymore. osmocon only logs periodically this
line:
TOA AVG is not 16 qbits, correcting (got 15)
And mobile says:
<0003> gsm322.c:474 Sync to ARFCN=694(DCS) rxlev=-80 (No sysinfo yet, ccch mode NONE)
<000e> gsm48_mm.c:353 Periodic location update
<0005> gsm48_mm.c:355 timer T3212 (periodic loc. upd. delay) has fired
<0005> gsm48_mm.c:4338 (ms 1) Received 'MM_EVENT_TIMEOUT_T3212' event in state MM IDLE, normal service
<000e> gsm48_mm.c:2222 Perform location update (MCC 262, MNC 07 LAC 0x27e9)
<0005> gsm48_mm.c:2356 LOCATION UPDATING REQUEST
<0005> gsm48_mm.c:2378 using LAI (mcc 262 mnc 07 lac 0x27e9)
<0005> gsm48_mm.c:2386 using TMSI 0xXXXXXXXX
<0005> gsm48_mm.c:917 new state MM IDLE, normal service -> wait for RR connection (location updating)
<0001> gsm48_rr.c:5575 (ms 1) Message 'RR_EST_REQ' received in state idle (sapi 0)
<000e> gsm48_rr.c:1352 Establish radio link due to mobility management request
<0003> gsm322.c:4049 (ms 1) Event 'EVENT_LEAVE_IDLE' for Cell selection in state 'C3 camped normally'
<0003> gsm322.c:829 new state 'C3 camped normally' -> 'connected mode 1'
<0003> gsm322.c:3665 Going to camping (normal) ARFCN 664(DCS).
<0003> gsm322.c:452 Sync to ARFCN=664(DCS), but there is a sync already pending
<0001> gsm48_rr.c:355 new state idle -> connection pending
<0001> gsm48_rr.c:1504 CHANNEL REQUEST: 00 (Location Update no NECI)
Mobile says nothing when shutting the phone off or on:
OsmocomBB(ms)#shutdown
OsmocomBB(ms)#
OsmocomBB(ms)#no shutdown
OsmocomBB(ms)#
Only logs:
<0005> gsm48_mm.c:4342 (ms 1) Received 'MM_EVENT_IMSI_DETACH' event in state wait for RR connection (location updating)
<0005> gsm48_mm.c:1992 IMSI detach delayed.
Killing and restarting mobile leads to:
eeepc:~ # mobile -i 127.0.0.1
Copyright (C) 2008-2010 ...
Contributions by ...
License GPLv2+: GNU GPL version 2 or later
<http://gnu.org/licenses/gpl.html>
This is free software: you are free to change and redistribute it.
There is NO WARRANTY, to the extent permitted by law.
<000f> sim.c:1223 init SIM client
<0006> gsm48_cc.c:63 init Call Control
<0007> gsm480_ss.c:231 init SS
<0017> gsm411_sms.c:63 init SMS
<0001> gsm48_rr.c:5626 init Radio Ressource process
<0005> gsm48_mm.c:1327 init Mobility Management process
<0005> gsm48_mm.c:1040 Selecting PLMN SEARCH state, because no SIM.
<0002> gsm322.c:5037 init PLMN process
<0003> gsm322.c:5038 init Cell Selection process
<0003> gsm322.c:5095 Read stored BA list (mcc=262 mnc=01 Germany, T-Mobile)
<0003> gsm322.c:5095 Read stored BA list (mcc=262 mnc=07 Germany, O2)
Mobile '1' initialized, please start phone now!
VTY available on port 4247.
And layer1 still logs some:
TOA AVG is not 16 qbits, correcting (got 15)
TOA AVG is not 16 qbits, correcting (got 15)
TOA AVG is not 16 qbits, correcting (got 15)
Has anybody a clue how this could happen from time to time?
Cheers
Tim
As said in the topic, I don't know what is the difference between the two
.bin file. And when I try the osmocon app, only the
hello_world.compalram.bin works, why?
Thanks in advance.
--
View this message in context: http://baseband-devel.722152.n3.nabble.com/What-s-the-difference-between-th…
Sent from the baseband-devel mailing list archive at Nabble.com.
Hi list,
Yesterday when I tried to to make a new build of sylvain/testing I encountered following errors when running make(and also when running make HOST_layer23_CONFARGS=--enable-transceiver):
--------------------------------------
make -C target/firmware CROSS_COMPILE=arm-elf-
make[1]: Entering directory `/root/osmocom-bb/src/target/firmware'
apps/trx/trx.c:22:22: inttypes.h: No such file or directory
make[1]: Leaving directory `/root/osmocom-bb/src/target/firmware'
make[1]: Entering directory `/root/osmocom-bb/src/target/firmware'
apps/trx/trx.c:22:22: inttypes.h: No such file or directory
make[1]: *** No rule to make target `apps/trx/trx.p', needed by `all'. Stop.
make[1]: Leaving directory `/root/osmocom-bb/src/target/firmware'
make: *** [firmware] Error 2
-------------------------------------------
Master branch builds fine on backtrack 5 r2 and so did also Sylvain/testing earlier. Searching mailing-list gives some info that removing inttypes.h can be done as that "is taken care of by upstrean libosmocore".However I have read that inntypes.h should exist.
I tested and removed inttypes.h in trx/trx.c. Recompiling gives an error message about parse error before debug-message PRIu32 on line 69 in trx/trx.c. Commenting out that line makes it build, but as info obtained earlier I now guess I have also removed some key-functionality and my approach is wrong?
Further searching gave some unclear/vague(mostly for other situations) hints that the line #include <inttypes.h> could be replaced by:
#ifdef HAVE_STDINT_H
#include <stdint.h>
#else
#include <include <inttypes.h>
#endif
I tested replacing #include <inttypes.h> by the abovein trx.c also but it didn't work.
Any ideas or hints what migh be wrong?
Enclosed is the full build-error-log from running without making any changes to inttypes.h.
Regards
erich
Hi all!
This is the announcement for the latest incarnation of our bi-weekly
Osmocom Berlin meeting.
January 23, 8pm @ CCC Berlin, Marienstr. 11, 10113 Berlin
There is no formal presentation scheduled for this meeting. However,
we'll have a progress report + demonstration of current osmo-pcu.
If you are interested to show up, feel free to do so. The meeting is
free as in "free beer", despite no actual free beer being around ;)
Regards,
Harald
--
- Harald Welte <laforge(a)gnumonks.org> http://laforge.gnumonks.org/
============================================================================
"Privacy in residential applications is a desirable marketing option."
(ETSI EN 300 175-7 Ch. A6)
Hi,
Does anyone know if gsm450 is encrypted with A5/1?
and who is using gsm450 in belgium
I can see signals on my ettus + external ant. there...
kind regards
Dear List
I tried to modify filter of osmocom c118 but i found that its not getting
signals.
loosing all signalls and showing all on 115dbm to 120dbm.
what could have gone wrong ??
--
Akib Sayyed
Matrix-Shell
akibsayyed(a)gmail.com
akibsayyed(a)matrixshell.com
Mob:- +91-966-514-2243
hi,
i would like to start implementing the trx manager interface support to
osmo-bts. before going to work, i'm writing this mail, because i like to
read some pros and cons for my approach.
as already stated, thomas a. cooper already implemented an interface
between sysmo-bts's dsp device and trx manager interface by using code
from openbts, running in an own process [1]. i would like to follow a
different approach by writing a scheduler and adding the udp interface
for the trx(s). some benefits are in my oppinion:
- not having an extra process running with additional latency and overhead
- smaller code, because only a small multiframe scheduler + udp
interface for the trx is required (coding scheme and forward error
correction code can be used from libosmocore.)
- no running after dsp's api changes, (caused by newer firmware of sysmobts)
- trx specific features and limitations can be considered. (vty options
for setting special features, limitations can affect oml ack/nack
responses to be considered by bsc)
- no use of multithreading, use of talloc. the code is easier to debug
and so becomes more stable.
- easy to add initial support for BCCH(+SDCCH4), SDCCH8, TCH/F, TCH/H,
PDCH (gprs) for a whide range of applications.
comments are welcome.
regards,
andreas
[1]
http://scholar.lib.vt.edu/theses/available/etd-05082012-141540/unrestricted…
hi,
while reading about SMS state machines, i found some drawings that are
not in the specs, but quite useful to understand some processes. they are:
- MM idle process (MS side)
- additions to CC (MS side)
- SMC process (MS and network side)
see http://home.eversberg.eu/gsm
they might be useful and so i think they should be placed in the wiki. i
would suggest to put them to OsmocomBB wiki in the "GSM Documentation"
section. but i don't know if it is ok to publish the CC process, because
it contains a scan of the original spec.
any suggestions?
regards,
andreas
Hello.
Current implementation of osmo_hexparse have couple of limitations (which are
undocumented btw):
* it refuses to parse odd-length numbers (e. g. 7abdf)
* it fails while parsing 0x prefix (e. g. 0xdead)
Both could be worked around by upper-layer code of course but since both cases above
are perfectly valid hexadecimal numbers I think they should be handled by
osmo_hexparse internally without complicating life of library users.
Attached patch does just that. Please review and merge if it feels OK.
--
best regards,
Max, http://fairwaves.ru
hi,
i just encountered the following problem:
the network assigns me from TS 1 to TS 3 it worked, but not when it did
another assigment from TS 3 to TS4. i just got noise instead of valid
SACCH frames.
TS Chg forth: 1 -> 3 | 1856
...
TS Chg forth: 3 -> 4 | 1875
this is the wireshark trace of both assignments. they only differ in the
assigned slot:
Frame 3225: 81 bytes on wire (648 bits), 81 bytes captured (648 bits)
Ethernet II, Src: 00:00:00_00:00:00 (00:00:00:00:00:00), Dst:
00:00:00_00:00:00 (00:00:00:00:00:00)
Internet Protocol Version 4, Src: 127.0.0.1 (127.0.0.1), Dst: 127.0.0.1
(127.0.0.1)
User Datagram Protocol, Src Port: 52261 (52261), Dst Port: gsmtap (4729)
GSM TAP Header, ARFCN: 34 (Downlink), TS: 1, Channel: SDCCH/8 (0)
Link Access Procedure, Channel Dm (LAPDm)
GSM A-I/F DTAP - Assignment Command
Protocol Discriminator: Radio Resources Management messages
DTAP Radio Resources Management Message Type: Assignment Command (0x2e)
Channel Description 2 - Description of the First Channel, after time
0000 1... = TCH/F + FACCH/F and SACCH/F
.... .011 = Timeslot: 3
000. .... = Training Sequence: 0
...1 .... = Hopping channel: Yes
Hopping channel: MAIO 0
Hopping channel: HSN 0
Power Command
0... .... = Spare: 0
.0.. .... = EPC_mode: Channel(s) not in EPC mode
..0. .... = FPC_EPC: FPC not in use/C not in use for uplink
power control
...0 0101 = POWER LEVEL: 5
Frequency List - Frequency List, after time
Element ID: 5
Length: 16
00.. 000. = Format Identifier: bit map 0 (0x00)
List of ARFCNs = 99 34
Channel Mode - Mode of the First Channel(Channel Set 1)
Element ID: 99
Channel Mode: speech full rate or half rate version 2(GSM EFR) (33)
No. Time Source Destination Protocol
Info
3243 464.672890 127.0.0.1 127.0.0.1 LAPDm
I, N(R)=1, N(S)=2(DTAP) (RR) Assignment Command
Frame 3243: 81 bytes on wire (648 bits), 81 bytes captured (648 bits)
Ethernet II, Src: 00:00:00_00:00:00 (00:00:00:00:00:00), Dst:
00:00:00_00:00:00 (00:00:00:00:00:00)
Internet Protocol Version 4, Src: 127.0.0.1 (127.0.0.1), Dst: 127.0.0.1
(127.0.0.1)
User Datagram Protocol, Src Port: 52261 (52261), Dst Port: gsmtap (4729)
GSM TAP Header, ARFCN: 99 (Downlink), TS: 3, Channel: FACCH/F (0)
Link Access Procedure, Channel Dm (LAPDm)
GSM A-I/F DTAP - Assignment Command
Protocol Discriminator: Radio Resources Management messages
DTAP Radio Resources Management Message Type: Assignment Command (0x2e)
Channel Description 2 - Description of the First Channel, after time
0000 1... = TCH/F + FACCH/F and SACCH/F
.... .100 = Timeslot: 4
000. .... = Training Sequence: 0
...1 .... = Hopping channel: Yes
Hopping channel: MAIO 0
Hopping channel: HSN 0
Power Command
0... .... = Spare: 0
.0.. .... = EPC_mode: Channel(s) not in EPC mode
..0. .... = FPC_EPC: FPC not in use/C not in use for uplink
power control
...0 0101 = POWER LEVEL: 5
Frequency List - Frequency List, after time
Element ID: 5
Length: 16
00.. 000. = Format Identifier: bit map 0 (0x00)
List of ARFCNs = 99 34
Channel Mode - Mode of the First Channel(Channel Set 1)
Element ID: 99
Channel Mode: speech full rate or half rate version 2(GSM EFR) (33)
any idea why this does not work? i used the "[WIP] Ugly hack to
compensate lost time on TS change (high TS -> low TS)" path.
regards,
andreas
Speaker: Sylvain Munaut
or how to turn a phone into a BTS
The calypso baseband and its companion chips are used on the Motorola C123
among other and are now well known for being supported by the Osmocom-BB
open source GSM baseband implementation. A couple years ago, it was hacked
a little further by using it as a raw bits capture device allowing the
interception of GSM traffic very cheaply.
This talk will present some further work on that platform, showing that
just because a device wasn't design for a given task doesn't mean it can't
do it. More specifically how you can hack this phone to act as a GSM
basestation and broadcast your own network.
http://youtu.be/xFjVcxMpA6c
Hi list,
I saw the interesting talk about turning the osmocombb-phone into a proof of concept bts using openbts. During the talk:When OpenBts
was configured(before using sipauthserve) was it the option --with-uhd (as is for umtrx )that was used?
Does anybody know when the code will be released?
[I built sylvain/testing branch as well as branch jolly/meas branch some days ago, but I couldn't find that code anywhere, so I guess it is not available anywhere yet]
regards
erich
On Thu, Jan 10, 2013 at 11:33 PM, Heiko Besemann <heiko(a)noordsee.de> wrote:
>
> Hello Alex,
You should send mail to the mailing list, instead of specific
individuals. This way, i) you may get a responder quicker, and ii)
information can reach other interested people.
>
> I read on Osmocom-BB mailing-list that you are using a GTA02 with
> cross-compiled tools. Well, I did cross-compiling of the sylvain/burst_ind
> branch for the OpenMoko, but starting osmocon I get an error that the
> higher non-standard baudrate can not be set to /dev/ttySAC0.
On the GTA02 the calypso is wired to one internal UART of the
application processor SoC. AFAIR the SoC only supports up to 115200
bps so it won't be usable with burst_ind.
Cheers,
Alex
Hi,
Erich, I'm using OpenBTS with USRP B100 & SBX.
I encountered new problem, maybe it's similar to initial problem.
Calls and MO SMS works fine (not in 100%, but it's ok). But MT SMS
does not work (actually I received only 1 SMS from many attempts).
Mobile log (error part, from line 454):
<0001> gsm48_rr.c:429 new SAPI 3 link state idle -> established
<000e> gsm48_rr.c:5042 Radio link SAPI3 is established
<0005> gsm48_mm.c:3911 (ms 1) Received 'RR_EST_IND' from RR in state
wait for network command (sapi 3)
<0001> gsm48_rr.c:662 MON: f=50 lev=>=-47 snr= 0 ber= 0 LAI=001 01
0001 ID=0001 TA=3 pwr=19 TS=0/0
<0001> gsm48_rr.c:2864 MEAS REP: pwr=19 TA=3 meas-invalid=0
rxlev-full=-47 rxlev-sub=-47 rxqual-full=0 rxqual-sub=0 dtx 0 ba 0
no-ncell-n 0
<0001> gsm48_rr.c:4767 Indicated ta 3 (actual ta 3)
<0001> gsm48_rr.c:4769 Indicated tx_power 19
<0001> gsm48_rr.c:4767 Indicated ta 3 (actual ta 3)
<0001> gsm48_rr.c:4769 Indicated tx_power 19
<0001> gsm48_rr.c:4984 MDL-Error (cause 4) ignoring
Dropping frame with 71 bit errors
<0001> gsm48_rr.c:4767 Indicated ta 3 (actual ta 3)
<0001> gsm48_rr.c:4769 Indicated tx_power 19
<0001> gsm48_rr.c:662 MON: f=50 lev=>=-47 snr=10 ber= 42 LAI=001 01
0001 ID=0001 TA=3 pwr=19 TS=0/0
<0001> gsm48_rr.c:2864 MEAS REP: pwr=19 TA=3 meas-invalid=0
rxlev-full=-47 rxlev-sub=-47 rxqual-full=0 rxqual-sub=0 dtx 0 ba 0
no-ncell-n 0
<0001> gsm48_rr.c:3389 channel release request with cause 0x62
<0001> gsm48_rr.c:355 new state dedicated -> release pending
In trace (from packet 5509):
BTS send SABM
MS receive SABM
MS respond with UA
BTS receive UA
BTS send I frame
MS receive SABM (extra message?)
MS respond with UA
BTS receive UA
BTS send DM (disconnect request? because of extra UA respond from MS?)
BTS send Channel Release
after that MS receive I frame and send RR with ack but as I understand
this does not matter because of Chan Release..
Thanks,
Pavel
On Thu, Jan 10, 2013 at 6:02 PM, Erich Dachleger <edachleger(a)yahoo.com> wrote:
> What do you use to generate the network?
> The osmocombb-phone or other bts?
> cheers
> Erich
>
> ________________________________
> Fra: Pavel Baturko <pabftk(a)gmail.com>
> Til: baseband-devel(a)lists.osmocom.org
> Sendt: Mandag, 7. januar 2013 21.04
> Emne: MDL-Error in case of OsmocomBB+OpenBTS
>
> Hi list,
>
> I'm trying to connect my OsmocomBB phone to OpenBTS and I always got
> MDL-Error in mobile app log when MS trying to perform LU.
> Part of log (full mobile log in attach):
> <0001> gsm48_rr.c:355 new state connection pending -> dedicated
> <0005> gsm48_mm.c:3911 (ms 1) Received 'RR_EST_CNF' from RR in state wait
> for RR connection (location updating) (sapi 0)
> <0005> gsm48_mm.c:404 starting T3210 (loc. upd. timeout) with 20.0 seconds
> <0005> gsm48_mm.c:924 new state wait for RR connection (location updating)
> -> location updating initiated
> <0001> gsm48_rr.c:4984 MDL-Error (cause 3) ignoring
> <0001> gsm48_rr.c:4987 MDL-Error (cause 3) aborting
> <0001> gsm48_rr.c:355 new state dedicated -> idle
>
> In wireshark trace (from OpenBTS, attached) I see that MS sends LURequest
> (packet 359) and BTS responds with LUAccept (packet 440) but MS never
> receive this message because of error.
>
> As I understand this is "unsolicited UA response" from 08.58 (9.3.22) but I
> do not know how to fix that or properly debug.
> I'm using latest sylvain/testing and official OpenBTS 2.8. "Usual" (not with
> OsmocomBB) phones works with OpenBTS fine and OsmocomBB phones works fine
> with "usual" (not OpenBTS) networks.
>
> Thanks,
> Pavel
>
>
Hi list!
As described in Nico Golde's talk at 29c3, mobile operators can deactivate
encryption on MT SMSes. To check if a MT is encrypted I've started 'mobile'
with GSMTAP, and I've sent an sms to the mobile. Encryption seems to be
requested by the network. Now the question is: how can I be sure that
encryption is always activated? Should I exaustively send messages to the
mobile in order to look for unecrypted messages? Or is there some other
way? People who give stats about MNO do exaustive tests, or simply generate
a bunch of events and campute stats on those results?
Thanks for your answers/opinions.
Dario.
Hi guys
This is a question related to the compilation system of osmocom-bb. For an
unknown reason, something has gone wrong with my compiled binaries, so now
I would like to clean up everything as it was freshly checked out, before
restarting the compilation. How can I do it? Make clean and make distclean
seem not to be enough, since my compilation now fails with:
cd ./doc && tar cf html.tar */html
make[3]: Leaving directory
`/home/dario/Projects/mobile/osmocom-bb/src/shared/libosmocore/build-target'
make[2]: Leaving directory
`/home/dario/Projects/mobile/osmocom-bb/src/shared/libosmocore/build-target'
make[1]: Leaving directory
`/home/dario/Projects/mobile/osmocom-bb/src/shared/libosmocore/build-target'
cd host/layer23 && ./configure
checking for a BSD-compatible install... /usr/bin/install -c
checking whether build environment is sane... yes
checking for a thread-safe mkdir -p... /bin/mkdir -p
checking for gawk... no
checking for mawk... mawk
checking whether make sets $(MAKE)... yes
checking whether make supports nested variables... yes
checking whether make sets $(MAKE)... (cached) yes
checking for gcc... gcc
checking whether the C compiler works... yes
checking for C compiler default output file name... a.out
checking for suffix of executables...
checking whether we are cross compiling... no
checking for suffix of object files... o
checking whether we are using the GNU C compiler... yes
checking whether gcc accepts -g... yes
checking for gcc option to accept ISO C89... none needed
checking for style of include used by make... GNU
checking dependency style of gcc... gcc3
checking for ranlib... ranlib
checking for pkg-config... /usr/bin/pkg-config
checking pkg-config is at least version 0.9.0... yes
checking for LIBOSMOCORE... no
configure: error: Package requirements (libosmocore) were not met:
No package 'libosmocore' found
Consider adjusting the PKG_CONFIG_PATH environment variable if you
installed software in a non-standard prefix.
Alternatively, you may set the environment variables LIBOSMOCORE_CFLAGS
and LIBOSMOCORE_LIBS to avoid the need to call pkg-config.
See the pkg-config man page for more details.
make: *** [host/layer23/Makefile] Error 1
How can I clean up everything?
Any help appreciated.
Thanks
Dario.
Hi list,
I'm trying to connect my OsmocomBB phone to OpenBTS and I always
got MDL-Error in mobile app log when MS trying to perform LU.
Part of log (full mobile log in attach):
<0001> gsm48_rr.c:355 new state connection pending -> dedicated
<0005> gsm48_mm.c:3911 (ms 1) Received 'RR_EST_CNF' from RR in state wait
for RR connection (location updating) (sapi 0)
<0005> gsm48_mm.c:404 starting T3210 (loc. upd. timeout) with 20.0 seconds
<0005> gsm48_mm.c:924 new state wait for RR connection (location updating)
-> location updating initiated
<0001> gsm48_rr.c:4984 MDL-Error (cause 3) ignoring
<0001> gsm48_rr.c:4987 MDL-Error (cause 3) aborting
<0001> gsm48_rr.c:355 new state dedicated -> idle
In wireshark trace (from OpenBTS, attached) I see that MS sends LURequest
(packet 359) and BTS responds with LUAccept (packet 440) but MS never
receive this message because of error.
As I understand this is "unsolicited UA response" from 08.58 (9.3.22) but I
do not know how to fix that or properly debug.
I'm using latest sylvain/testing and official OpenBTS 2.8. "Usual" (not
with OsmocomBB) phones works with OpenBTS fine and OsmocomBB phones works
fine with "usual" (not OpenBTS) networks.
Thanks,
Pavel
I've done it and now everything works, thanks. But I've noticed that this
requirement is not documented anywhere. Wiki should be updated or new users
will stuck at this point.
On Mon, Jan 7, 2013 at 7:00 PM, Erich Dachleger <edachleger(a)yahoo.com>wrote:
> Did you install libosmocore first?One must do that now
> regards
> erich
>
>
Hi list,
I want to play with the mobile_app with TX and SIM-card support, so I checkout the sylvain/testing branch described in the wiki but the following error message occurs.
The master branch work's very fine on my HW (C123).
Can someone give me a hint, what should I do to get a working testset with SIM support?
Here the shell-output by makeing sylvain/testing branch
......
CC gsm411_sms.o
gsm411_sms.c: In Funktion »gsm340_rx_tpdu«:
gsm411_sms.c:228:19: Warnung: Variable »sms_mms« gesetzt, aber nicht verwendet [-Wunused-but-set-variable]
gsm411_sms.c: In Funktion »gsm411_rx_rp_ud«:
gsm411_sms.c:375:2: Warnung: Format »%li« erwartet Argumenttyp »long int«, aber Argument 7 hat Typ »int« [-Wformat]
gsm411_sms.c: In Funktion »gsm411_tx_sms_submit«:
gsm411_sms.c:657:3: Warnung: Übergabe des Arguments 4 von »gsm411_smc_init« von inkompatiblem Zeigertyp [standardmäßig aktiviert]
/home/kasio/osmocom-bb/src/shared/libosmocore/include/osmocom/gsm/gsm0411_smc.h:46:6: Anmerkung: »int (*)(struct gsm411_smc_inst *, int, struct msgb *, int)« erwartet, aber Argument hat Typ »int (*)(struct gsm411_smc_inst *, int, struct msgb *)«
gsm411_sms.c:657:3: Fehler: zu viele Argumente für Funktion »gsm411_smc_init«
/home/kasio/osmocom-bb/src/shared/libosmocore/include/osmocom/gsm/gsm0411_smc.h:46:6: Anmerkung: hier deklariert
gsm411_sms.c:659:3: Fehler: zu viele Argumente für Funktion »gsm411_smr_init«
/home/kasio/osmocom-bb/src/shared/libosmocore/include/osmocom/gsm/gsm0411_smr.h:27:6: Anmerkung: hier deklariert
gsm411_sms.c: In Funktion »gsm411_rcv_sms«:
gsm411_sms.c:911:4: Warnung: Übergabe des Arguments 4 von »gsm411_smc_init« von inkompatiblem Zeigertyp [standardmäßig aktiviert]
/home/kasio/osmocom-bb/src/shared/libosmocore/include/osmocom/gsm/gsm0411_smc.h:46:6: Anmerkung: »int (*)(struct gsm411_smc_inst *, int, struct msgb *, int)« erwartet, aber Argument hat Typ »int (*)(struct gsm411_smc_inst *, int, struct msgb *)«
gsm411_sms.c:911:4: Fehler: zu viele Argumente für Funktion »gsm411_smc_init«
/home/kasio/osmocom-bb/src/shared/libosmocore/include/osmocom/gsm/gsm0411_smc.h:46:6: Anmerkung: hier deklariert
gsm411_sms.c:913:4: Fehler: zu viele Argumente für Funktion »gsm411_smr_init«
/home/kasio/osmocom-bb/src/shared/libosmocore/include/osmocom/gsm/gsm0411_smr.h:27:6: Anmerkung: hier deklariert
make[3]: *** [gsm411_sms.o] Fehler 1
make[3]: Verlasse Verzeichnis '/home/kasio/osmocom-bb/src/host/layer23/src/mobile'
make[2]: *** [all-recursive] Fehler 1
make[2]: Verlasse Verzeichnis '/home/kasio/osmocom-bb/src/host/layer23/src'
make[1]: *** [all-recursive] Fehler 1
make[1]: Verlasse Verzeichnis '/home/kasio/osmocom-bb/src/host/layer23'
make: *** [host/layer23/layer23] Fehler 2
kasio@T60:~/osmocom-bb/src$
Thanks a lot for your help.
kasio
Hey Baseband,
I've got a stock of SIMs I bought and programmed already, but I
unfortunately (and stupidly) forgot to set the SMSC. This is causing me
heaps of issues, as each phone now has to have the SMSC set manually. I was
hoping to hack up a quick script which just inserts the SMSC onto the SIM
without needing to regenerate the ki or IMSI. Lining those up with my
database is rife with hazard.
Looking at the pySim-prog, it looks like this probably isn't possible; all
of the data seems to get bundled together and so changing the SMSC length
will cause other data to be corrupted. Is that right? I just wanted to see
what ya'll think would be the best way for me to remedy my particular
stupidity.
Thanks!
Hi list,
I'm running layer23 apps on the Application Processor of the OpenMoko
GTA02, which is also an ARM. I noticed that some parts of code try to
access words in memory which are not naturally aligned.
[ The first symptom was "Err from socket: Bad address" given by
osmocon. This is because a bogus length header read from the L2 unix
socket was overflowing a static 4K buffer. The bogus length was due
to an unaligned uint16_t write in osmo_send_l1() -- for an
L1CTL_DATA_REQ I think. ]
The easy and inefficient workaround for this is to ask the kernel[1]
to fix up these accesses:
echo 3 > /proc/cpu/alignment
Cheers,
Alex
[1] http://lxr.linux.no/#linux+v3.7.1/Documentation/arm/mem_alignment